Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a site that will scan my website and check it for security holes?

Preferably one that doesn't charge.

share|improve this question
I highly doubt it... at least not one that is well-intentioned. And especially not free. Instead, you should hire a developer who knows how to check for these things. – jtbandes Sep 6 '09 at 4:46
This is probably better asked on Stackoverflow (if you're the site's developer) or Serverfault (if you're the site's admin). – derobert Sep 6 '09 at 6:40
Good question, but doesn't belong on Super User. – Sasha Chedygov Sep 10 '09 at 19:18

You might want to look into WebScarab.

WebScarab is a framework for analysing applications that communicate using the HTTP and HTTPS protocols. It is written in Java, and is thus portable to many platforms. WebScarab has several modes of operation, implemented by a number of plugins. In its most common usage, WebScarab operates as an intercepting proxy, allowing the operator to review and modify requests created by the browser before they are sent to the server, and to review and modify responses returned from the server before they are received by the browser. WebScarab is able to intercept both HTTP and HTTPS communication. The operator can also review the conversations (requests and responses) that have passed through WebScarab.

Vulnerability assessment in web applications and web sites is not common available for free, and usually involves hiring a security consultant/researcher.

share|improve this answer
The firefox plug in tamperdata fits the common usage; not to mention IE's fiddler. – dlamblin Sep 10 '09 at 19:30

I asked about Web Vuln scanners over on Server Fault recently. The only hosted option that was suggested was's Security service. I haven't tried it yet, but they do offer a 14 day freebie.

share|improve this answer

There are some, but the free ones don't really tell you anything useful. I have personally yet to find a tool that fuzzes the input fields of every form and tests for sql vulnerabilities that seems... reputable. You sort of are best off doing this stuff by hand and going through a check list.

share|improve this answer

Take a look at ShieldsUp by Gibson Research.

I've used it in the past and it is free.

share|improve this answer
I believe this one is for personal computers, not web-sites – dlamblin Sep 10 '09 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .